7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d

General

Target

7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
Size

264KB
MD5

6fbde64b23dfb7b5e25f60650340e7f2
SHA1

3d9318a7fbb2871938e3ac4221413c1749194bf5
SHA256

7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d
SHA512

bb2f3bf2031af860ee1b756533c306fad3c0aa095eb5e4209a96e67bb50a3cf3c3aa54e411cf0b0911624449cdb01a74c6979733a32881fe39f491a5bacb6c1d
SSDEEP

3072:/re+a+3dN5eLRkgUA1nQZwFGVO4Mqg+WDY:C+aMgLRp1nQ4QLd

Score

7^/10

spyware stealer

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Logo1_.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini	Logo1_.exe

Executes dropped EXE 2 IoCs

Processes:

Logo1_.exe7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe

pid process

1256 Logo1_.exe
2364 7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
1256	Logo1_.exe
2364	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Logo1_.exe

description	ioc	process
File opened (read-only)	\??\S:	Logo1_.exe
File opened (read-only)	\??\Q:	Logo1_.exe
File opened (read-only)	\??\O:	Logo1_.exe
File opened (read-only)	\??\K:	Logo1_.exe
File opened (read-only)	\??\J:	Logo1_.exe
File opened (read-only)	\??\Z:	Logo1_.exe
File opened (read-only)	\??\W:	Logo1_.exe
File opened (read-only)	\??\T:	Logo1_.exe
File opened (read-only)	\??\N:	Logo1_.exe
File opened (read-only)	\??\M:	Logo1_.exe
File opened (read-only)	\??\H:	Logo1_.exe
File opened (read-only)	\??\E:	Logo1_.exe
File opened (read-only)	\??\Y:	Logo1_.exe
File opened (read-only)	\??\V:	Logo1_.exe
File opened (read-only)	\??\R:	Logo1_.exe
File opened (read-only)	\??\I:	Logo1_.exe
File opened (read-only)	\??\X:	Logo1_.exe
File opened (read-only)	\??\P:	Logo1_.exe
File opened (read-only)	\??\L:	Logo1_.exe
File opened (read-only)	\??\U:	Logo1_.exe
File opened (read-only)	\??\G:	Logo1_.exe

Drops file in Program Files directory 64 IoCs

Processes:

Logo1_.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AFTRNOON\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\hr-hr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ar-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\id\LC_MESSAGES\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\he-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\tr-tr\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\it-it\_desktop.ini	Logo1_.exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ko\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\ja-JP\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\MSBuild\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\nb-no\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Google\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\he-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Windows Media Player\uk-UA\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\cmm\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\da-dk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\en-ae\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ru-ru\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\de-DE\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\en-gb\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Internet Explorer\fr-FR\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fi-fi\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\root\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\en-il\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\images\themes\dark\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\sk-sk\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\pl-pl\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Office Setup Controller\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hi\_desktop.ini	Logo1_.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\win8-scrollbar\themes\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fi-fi\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files-select\css\_desktop.ini	Logo1_.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\_desktop.ini	Logo1_.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\ko-kr\_desktop.ini	Logo1_.exe
File created	C:\Program Files\Java\jdk-1.8\legal\javafx\_desktop.ini	Logo1_.exe

Drops file in Windows directory 4 IoCs

Processes:

7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exeLogo1_.exe

description	ioc	process
File created	C:\Windows\rundl132.exe	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
File created	C:\Windows\Logo1_.exe	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
File opened for modification	C:\Windows\rundl132.exe	Logo1_.exe
File created	C:\Windows\Dll.dll	Logo1_.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exeLogo1_.exe

pid	process
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe
1256	Logo1_.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exenet.exeLogo1_.execmd.exenet.exenet.exe

description	pid	process	target process
PID 2272 wrote to memory of 4808	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	net.exe
PID 2272 wrote to memory of 4808	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	net.exe
PID 2272 wrote to memory of 4808	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	net.exe
PID 4808 wrote to memory of 396	4808	net.exe	net1.exe
PID 4808 wrote to memory of 396	4808	net.exe	net1.exe
PID 4808 wrote to memory of 396	4808	net.exe	net1.exe
PID 2272 wrote to memory of 3204	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	cmd.exe
PID 2272 wrote to memory of 3204	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	cmd.exe
PID 2272 wrote to memory of 3204	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	cmd.exe
PID 2272 wrote to memory of 1256	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	Logo1_.exe
PID 2272 wrote to memory of 1256	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	Logo1_.exe
PID 2272 wrote to memory of 1256	2272	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe	Logo1_.exe
PID 1256 wrote to memory of 2108	1256	Logo1_.exe	net.exe
PID 1256 wrote to memory of 2108	1256	Logo1_.exe	net.exe
PID 1256 wrote to memory of 2108	1256	Logo1_.exe	net.exe
PID 3204 wrote to memory of 2364	3204	cmd.exe	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
PID 3204 wrote to memory of 2364	3204	cmd.exe	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
PID 3204 wrote to memory of 2364	3204	cmd.exe	7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
PID 2108 wrote to memory of 2468	2108	net.exe	net1.exe
PID 2108 wrote to memory of 2468	2108	net.exe	net1.exe
PID 2108 wrote to memory of 2468	2108	net.exe	net1.exe
PID 1256 wrote to memory of 3264	1256	Logo1_.exe	net.exe
PID 1256 wrote to memory of 3264	1256	Logo1_.exe	net.exe
PID 1256 wrote to memory of 3264	1256	Logo1_.exe	net.exe
PID 3264 wrote to memory of 3972	3264	net.exe	net1.exe
PID 3264 wrote to memory of 3972	3264	net.exe	net1.exe
PID 3264 wrote to memory of 3972	3264	net.exe	net1.exe
PID 1256 wrote to memory of 3432	1256	Logo1_.exe	Explorer.EXE
PID 1256 wrote to memory of 3432	1256	Logo1_.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3432

C:\Users\Admin\AppData\Local\Temp\7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
"C:\Users\Admin\AppData\Local\Temp\7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe"
2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2272

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
3⤵
- Suspicious use of WriteProcessMemory
PID:4808

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
4⤵
PID:396

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49CA.bat
3⤵
- Suspicious use of WriteProcessMemory
PID:3204

C:\Users\Admin\AppData\Local\Temp\7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe
"C:\Users\Admin\AppData\Local\Temp\7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe"
4⤵
- Executes dropped EXE
PID:2364

C:\Windows\Logo1_.exe
C:\Windows\Logo1_.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1256

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:2468

C:\Windows\SysWOW64\net.exe
net stop "Kingsoft AntiVirus Service"
4⤵
- Suspicious use of WriteProcessMemory
PID:3264

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
5⤵
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe
Filesize
251KB

MD5
0a24fc417a4fe6a03a95f1dbb66cb5f6

SHA1
1fefa17bb09541adef0b146ca9ac546a0b8f229d

SHA256
e83af94b6a6b186e7fff007ad2ccf6ccc3cc760735966b353d50715d4a97d637

SHA512
e7543c444dbd12aeb05afb484742e7149da27c9d65534b4ea31d730d53a724c247726bfefc39b426bedf4049e2411724353035ef5377d80a4bff29924eeaa348

Download Submit
C:\Program Files\7-Zip\7z.exe
Filesize
577KB

MD5
2b3c60b14548c1aeb11e7de6cdf7d083

SHA1
4b45ca22c5ef7ef0557ff2d063dae2fb98a6242a

SHA256
afbc4566d0609162cb50230987f26e7cf24c1ade3d1d27980f6f365dbd719a98

SHA512
811165844bc22075d809c47839ca389fce52598c50dfb668aa1b0f632f8e5d519c698a7a284c71a2a16fc362bf146288c327b92a77b91417c3e1b5d559de01da

Download Submit
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize
643KB

MD5
b06c23c388c6c6a3219fdaf5efaabccf

SHA1
ada13c3c4449d222de774ebd037078ba31d33cd2

SHA256
8efeb8be3a4ae59e4106e6c1d9e122d8ecb84b71cf01796f27d94ecfe80e0809

SHA512
aefc2fbbf660ee465ac7f174ab8f3de242c352d473a02ee96214d29a5e854e88c7ad842685bdb81698c8d51e0b597d7379c3a039e704839be748fe96a68c23b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\$$a49CA.bat
Filesize
722B

MD5
a00fd69b13f9c39b105483f65c31b33c

SHA1
ffd54ecf7dd9101739756ae2c9b8152d06d3a1d5

SHA256
eedfb37e604c16a88b18c8cf2ac8cc66a09c42e194da5c7de92f950d7df49370

SHA512
a6823560a93ed7034b5a36aef217d8053fea7dd773c70ecd77d4e69f79988b1305fdbb25f7effdadf45a35cc62a184c00247a6a42bfd85275f5fde47932148e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7b24d4153a1e57ae7a3804a4d9ae4c4b9125206896e346c8cb86ddf823cd325d.exe.exe
Filesize
231KB

MD5
6f581a41167d2d484fcba20e6fc3c39a

SHA1
d48de48d24101b9baaa24f674066577e38e6b75c

SHA256
3eb8d53778eab9fb13b4c97aeab56e4bad2a6ea3748d342f22eaf4d7aa3185a7

SHA512
e1177b6cea89445d58307b3327c78909adff225497f9abb8de571cdd114b547a8f515ec3ab038b583bf752a085b231f6329d6ca82fbe6be8a58cd97a1dbaf0f6

Download Submit
C:\Windows\Logo1_.exe
Filesize
33KB

MD5
61300f747b4c375abdceed9275de3b2f

SHA1
2db699a3c396b69340c25c652c1185a9ebf738a7

SHA256
f08b49abf159875014578ca5e9cd25ca85bf3daac24f35a8fd412e23c32761d7

SHA512
bf173058edce7a41a62af48b7775bc8796e6d299a250e508e74a5bd03de239ead3ec594e5eb312d443dc7b6983134e958824303c3d903ae09599ae61fe008c34

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2818691465-3043947619-2475182763-1000\_desktop.ini
Filesize
9B

MD5
e7957b9f3d9556c996418169821a7993

SHA1
b7028de0f91d2e50a8d5f6d23613331a2784a142

SHA256
71a21a13d7822776d52d9a6146651dc9155db9f0bfbd978acf43d12dea2a8539

SHA512
72bc8552047095449fa4c3c21300183acfc7b33e6ab69c11435542e2862cb9e896bbfdedaeb97ec6edac8ed68220507a302d1ed2217624c97f6e9a83c0d3a285

Download Submit
memory/1256-11-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1256-18-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1256-5226-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1256-8784-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2272-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2272-9-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads